In short: Cyber insurance security awareness training means running, and recording, the staff training and phishing simulations that insurers ask about on proposal and renewal forms. Insurers want to know whether people are trained, how often and how you test them. Accurate answers backed by completion and simulation reports protect your cover if you ever need to claim.
Why insurers ask about training
Insurers know that many incidents start with a person: a phishing email, a fake login page, a convincing payment request or a fake IT support approach. The NCSC's cyber insurance guidance notes that applying for a policy may require details of your technical, procedural and human controls, and that insurers may set minimum security requirements. It also advises not to stop at an insurer's minimum, because that baseline may not protect what matters most to you.
Typical questions about people include:
- Do all staff complete security awareness training, and how often?
- Do you run phishing simulations, and do people who fall for them get further training?
- Is there a process for verifying changes to supplier bank details or unusual payment requests?
- How do staff report suspicious emails?
- Are new starters trained when they join?
Wording varies between insurers and brokers, so read each question carefully and answer the one asked.
Answer accurately: it matters at claim time
The NCSC is clear that if you misrepresent your security measures, the insurer may not have to pay a claim. It also notes that most policies are reassessed every 12 months, so your answers need to stay true through the year and you should tell your insurer about changes.
Three common traps:
- Saying "all staff" when it is really most staff: leavers, contractors and new starters are often missed
- Describing a one-off session as ongoing training: if the form says "regular", be ready to show regular
- Ticking "phishing simulation" for an exercise that lapsed: if the last campaign was a long time ago, say so or restart it
A managed programme removes the guesswork, because coverage and dates come straight from the platform.
The evidence to keep
Keep a simple evidence pack that you can share with your broker or insurer:
| Evidence | What it shows | Where it comes from |
|---|---|---|
| Training completion report, per person, with dates | Coverage and frequency | Your training platform |
| New starter induction records | People are trained when they get access | Platform or HR |
| Phishing simulation summaries and trends | Training is tested and behaviour is improving | Platform reports |
| Report button activity | Staff actively report suspicious messages | Platform or email security |
| Payment verification procedure and finance training | Controls against invoice fraud | Your finance policy and BEC training |
| Policy acknowledgements | Staff have accepted acceptable use and data handling rules | Platform or HR system |
| Board reporting | Leaders oversee the risk | Quarterly summary; see measuring effectiveness |
Keep these for at least the period of the policy, and update them before renewal.
A worked example: the RPA for academy trusts
The Department for Education's Risk Protection Arrangement (RPA) is an alternative to commercial insurance for academy trusts and eligible schools, and it shows clearly how training can become a condition of cover. Its cyber cover conditions include keeping offline backups, registering with Police CyberAlarm, having a cyber response plan and ensuring that staff and governors with access to the trust's IT complete NCSC cyber security training each year.
If a condition is not met when an incident happens, cover may not apply. The lesson applies to any policy: training only counts if you can prove it. Check the current RPA membership rules on GOV.UK, and see security awareness training for schools for how to keep a completion register.
Training alongside the technical basics
Insurers ask about people, but they also ask about MFA, backups, patching and endpoint protection. The NCSC recommends putting basic protections in place, such as those certified by Cyber Essentials, before buying cover, and IASME arranges cyber liability insurance for eligible UK organisations that certify their whole organisation; see Cyber Essentials on our specialist site. Training complements those controls rather than replacing them; see Cyber Essentials and security awareness training.
For the wider picture of who expects training, see is security awareness training a legal requirement?
How we help
We set up a programme that matches what your insurer asks for, run it all year and give you an evidence pack before each renewal: completion, simulations, reporting and finance-team training. We choose a platform from the vendors we supply that produces clean reports, and run it through our managed security awareness training service. We cannot promise any change to your premium; that is for your insurer.
Contact us to prepare training evidence for your next renewal.
How Forever Systems runs your awareness programme
We are vendor-independent. We compare the security awareness and phishing simulation platforms that suit your size, sector, Microsoft 365 licensing and existing security tools, recommend one, then run it for you so training and phishing tests actually happen month after month.
- Baseline phishing simulation to see where you start
- Platform selection and set-up, with single sign-on and automatic user sync from Microsoft Entra ID or Google Workspace where the platform supports it
- A year-round plan of short training modules, simulated phishing campaigns and policy sign-off, including new-starter induction
- Sector and role content for schools, charities, healthcare, legal, finance, public sector and high-risk roles such as finance teams and help desks
- Reporting for the board, auditors, insurers and Cyber Essentials, showing completion, reporting and click trends
- Joined-up defences: email security, MFA, endpoint protection and dark web monitoring so training is backed by technology
Forever Systems Ltd provides IT and cyber security services to UK organisations. Pricing depends on user numbers and platform, so ask us for a quote.
Want help choosing and running security awareness training?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Do cyber insurers require security awareness training?
Many proposal forms ask whether staff are trained and phishing-tested, and some insurers set minimum security requirements. Requirements vary, so check your own proposal form and policy wording with your broker.
Will security awareness training reduce my cyber insurance premium?
It may help your application, but only your insurer can decide on terms or premiums. What training does reliably is let you answer the questions honestly and show evidence.
What evidence of training do insurers want?
Usually completion records with dates, details of phishing simulations and follow-up training, and sometimes your payment verification process. Keep platform reports and a short summary ready for renewal.
What happens if we overstate our training on a proposal form?
The NCSC warns that misrepresenting your security measures may mean the insurer does not have to pay a claim. Answer accurately and tell your insurer if things change during the policy year.
Do we need Cyber Essentials for cyber insurance?
Not always, but the NCSC recommends putting basic protections such as those certified by Cyber Essentials in place before buying cover, and notes that some insurers take recognised schemes into account. It covers technical controls; training covers people.